Comments (7)
One good option IMO is to use: https://github.com/oblador/react-native-keychain
from react-native-azure-auth.
Hi @oferRounds
- on one side you have referenced article about much more insecure
localStorage
notAsyncStorage
;) - on other side you are absolutely right - AsyncStorage is unencrypted storage and if your device is stolen and has unencrypted disk some one can access the file system and read the values in store.
But AsyncStorage is secure enough if you did not loos your device. It means - it can not be accessed from another app. - I will consider to switch to more secure storage
from react-native-azure-auth.
Yes, you are right - I referenced it as related to storing token on a client in general, in an unencrypted way
I wasn’t aware that localStorage
is a lot worse (Coming from the native mobile in my roots, not from the web)
Anyhow, thanks! Sounds good
from react-native-azure-auth.
localStorage
is a part of web browser API, it is not bound to any mobile app and there are many known attack ways to access data in localStorage, that does not meant to be accessible by anyone except owner.
In contrary AsyncStorage
is a React Native feature backed under the hood by different native storage types on iOS and Android. It is not accessible from other apps, it is bound to your app, i.e. it will be cleared (the related part of it) if the app has being uninstalled.
So in a some way it is secure ;)
Anyway it is recommended to use something like react-native-keychain
for a sensible data like tokens as you wrote.
Thanks for pointing this out!
from react-native-azure-auth.
Got you @vmurin, good to learn this info about the localStorage
And thanks for always welcoming the feedback!
from react-native-azure-auth.
I read the discussion, and I think I will switch from AsyncStorage to Keychain, but I am concerned about performance. Is Keychain's performance similar to Async Storage?
from react-native-azure-auth.
I did't googled for performance comparison between AsyncStorage and Keychain. But I suppose the performance in this case is not an issue. All network response times during auth process are much bigger.
from react-native-azure-auth.
Related Issues (20)
- Authentication IOS: Network request failed with face ID (IOS)
- ClearSession WebView iOS error when closing HOT 2
- Azure MFA Network Failure on iOS HOT 3
- Logout Redirect issue HOT 5
- First login attempt always fails HOT 3
- Expo Support HOT 1
- Logout WebView Not Closing HOT 3
- AcquireTokenSilent not working HOT 1
- [iOS] - Popup name edit HOT 2
- AcquireTokenSilent error - [TypeError: Cannot read property 'accessToken' of null] HOT 8
- i cant able to sign out from azuare ad. am usseing this in react native web
- Hide the address bar HOT 4
- Not able to change the authorityUrl/issuer using the authorize method HOT 11
- Data dog Rum is supported react native web ? HOT 1
- ClearSession is showing prompt to Sign In when user wants to Logout in iOS HOT 8
- Login screen is blank
- Is it possible to obtain the accessToken in JWT format? HOT 1
- Account login in app with lib not show MFA, but login with safari have MFA
- android stuck on "continue", does nothing HOT 2
- I using redirect_uri = myapp://app when login auto bypass not show MFA
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from react-native-azure-auth.